BYOD Threats Require Additional IT Resources: Webroot

Companies implementing BYOD programs face a number of security threats and are unprepared for potential incidents, a Webroot survey indicates.

Although bring-your-own-device, or BYOD, initiatives can bring a multitude of benefits to businesses, security remains a major concern for companies with limited IT resources. Most organizations that allow employees to bring their own devices are experiencing high rates of mobile threats, including lost or stolen devices, malware and compromised company data, according to the findings of a study sponsored by security specialist Webroot.

The study, based on a survey of endpoint and mobile-security decision makers in companies with 10 or more employees in the U.S., U.K. and Australia, found that more than half reported mobile threats, reduced employee productivity and disrupted business activities; 61 percent of survey respondents said they required additional IT resources to manage mobile security, resulting in higher costs.

Further, 63 percent of companies surveyed reported significant increases in demand for help desk support to repair, replace or manage the security of smartphones and tablets in the company, consuming as much as 36 percent of one help desk technician's time resolving these issues each month.

The study also found an overwhelming 82 percent of respondents said they believe that mobile devices create a high security risk within the corporate environment. Results indicated that mobile security is a high priority for half the companies supporting BYOD, equating to increased help desk support and consumption of valuable IT resources. In addition, 45 percent reported lost or stolen devices in the past year and 24 percent experienced mobile malware infections, crippling productivity and potentially compromising company and customer data.

While 46 percent of BYOD companies have implemented mobile security, only 40 percent of companies with fewer than 100 employees have mobile security. Despite having access to more IT resources, larger organizations--those with 500 or more employees--are at even higher risk.

According to the study, 67 percent had dealt with lost or stolen mobile devices and 32 percent had experienced mobile malware infections, creating widespread concern about the business impact of employee-owned devices within the enterprise. Overall, two-thirds of companies (67 percent) agree that the management of mobile-device security is a great burden on IT resources.

"Cyber-criminals are increasingly targeting employees as access portals to a company's infrastructure, intensifying the need for controls and layered defenses that can identify and mitigate attacks," Webroot Chief Information Security Officer Jacques Erasmus said in a statement. "As the popularity of employee-owned devices in the workplace continues to grow, this defense needs to be supplemented with a coherent but simple BYOD management strategy, underpinned by three elements: device-control policies, device-level security and mobile work force security training."

In conjunction with the study, Webroot offered businesses guidelines to reduce the risks associated with BYOD, such as creating a policy that governs how corporate IT staff can gain control over a personal device while maintaining network security and a requirement that personal and corporate mobile devices maintain up-to-date, corporate-approved (and preferably corporate-managed) security software installed to guard against malware and other security risks. “Let your business drive mobile-device-security policies and training. Business requirements and culture drive the policies, training and other up-front work you do to support your mobile work force security needs,” the guide advised.